0x1A Great Papers in Computer Security
|
|
- Marion Hicks
- 7 years ago
- Views:
Transcription
1 CS 380S 0x1A Great Papers in Computer Security Vitaly Shmatikov slide 1
2 Web Applications Big trend: software as a Web-based service Online banking, shopping, government, bill payment, tax prep, customer relationship management, etc. Cloud computing Applications hosted on Web servers Written in a mixture of PHP, Java, Perl, Python, C, ASP Security is rarely the main concern Poorly written scripts with inadequate input validation Sensitive data stored in world-readable files Recent push from Visa and Mastercard to improve security of data management (PCI standard) slide 2
3 Typical Web Application Design Runs on a Web server or application server Takes input from remote users Interacts with back-end databases and third parties Prepares and outputs results for users Dynamically generated HTML pages Content from many different sources, often including users themselves Blogs, social networks, photo-sharing websites slide 3
4 Dynamic Web Application Browser GET / HTTP/1.0 HTTP/ OK Web server index.php Database server slide 4
5 PHP: Hypertext Preprocessor Server scripting language with C-like syntax Can intermingle static HTML and code <input value=<?php echo $myvalue;?>> Can embed variables in double-quote strings $user = world ; echo Hello $user! ; or $user = world ; echo Hello. $user.! ; Form data in global arrays $_GET, $_POST, slide 5
6 SQL Widely used database query language Fetch a set of records SELECT * FROM Person WHERE Username= Vitaly Add data to the table INSERT INTO Key (Username, Key) VALUES ( Vitaly, 3611BBFF) Modify data UPDATE Keys SET Key=FA33452D WHERE PersonID=5 Query syntax (mostly) independent of vendor slide 6
7 Sample Code $selecteduser = $_GET['user']; $sql = "SELECT Username, Key FROM Key ". "WHERE Username='$selecteduser'"; $rs = $db->executequery($sql); What if user is a malicious string that changes the meaning of the query? slide 7
8 SQL Injection: Basic Idea Victim server Attacker 1 3 receive data from DB 2 unintended query This is an input validation vulnerability Unsanitized user input in an SQL query to backend database changes the meaning of query Specific case of command injection Victim SQL DB slide 8
9 Typical Login Prompt slide 9
10 User Input Becomes Part of Query Enter SELECT passwd Username FROM USERS Web browser (Client) and Password Web server WHERE uname IS $user DB slide 10
11 Normal Login Enter SELECT passwd Username FROM USERS Web browser (Client) and Password Web server WHERE uname IS smith DB slide 11
12 Malicious User Input slide 12
13 SQL Injection Attack SELECT passwd Web browser (Client) Enter Username and Password Web server FROM USERS WHERE uname IS ; DROP TABLE USERS; -- DB Eliminates all user accounts slide 13
14 Exploits of a Mom slide 14
15 Authentication with Back-End DB set UserFound=execute( SELECT * FROM UserTable WHERE username= & form( user ) & AND password= & form( pwd ) & ); User supplies username and password, this SQL query checks if user/password combination is in the database If not UserFound.EOF Authentication correct else Fail Only true if the result of SQL query is not empty, i.e., user/pwd is in the database slide 15
16 Using SQL Injection to Log In User gives username OR 1=1 -- Web server executes query set UserFound=execute( SELECT * FROM UserTable WHERE username= OR 1=1 -- ); Always true! Everything after -- is ignored! Now all records match the query, so the result is not empty correct authentication! slide 16
17 Another SQL Injection Example To authenticate logins, server runs this SQL command against the user database: SELECT * WHERE user= name AND pwd= passwd User enters OR WHERE pwd LIKE % as both name and passwd Server executes SELECT * WHERE user= OR WHERE pwd LIKE % AND pwd= OR WHERE pwd LIKE % [From The Art of Intrusion ] Wildcard matches any password Logs in with the credentials of the first person in the database (typically, administrator!) slide 17
18 Pull Data From Other Databases User gives username AND 1=0 UNION SELECT cardholder, number, exp_month, exp_year FROM creditcards Results of two queries are combined Empty table from the first query is displayed together with the entire contents of the credit card database slide 18
19 More SQL Injection Attacks Create new users ; INSERT INTO USERS ( uname, passwd, salt ) VALUES ( hacker, 38a74f, 3234); Reset password ; UPDATE USERS SET =hcker@root.org WHERE =victim@yahoo.com slide 19
20 Second-Order SQL Injection Second-order SQL injection: data stored in database is later used to conduct SQL injection For example, user manages to set uname to admin -- This vulnerability could exist if string escaping is applied inconsistently (e.g., strings not escaped) UPDATE USERS SET passwd= cracked WHERE uname= admin -- why does this work? Solution: treat all parameters as dangerous slide 20
21 CardSystems Attack (June 2005) CardSystems was a major credit card processing company Put out of business by a SQL injection attack Credit card numbers stored unencrypted Data on 263,000 accounts stolen 43 million identities exposed slide 21
22 SQL Injection in the Real World Oklahoma Department of Corrections divulges thousands of social security numbers (2008) Sexual and Violent Offender Registry for Oklahoma Data repository lists both offenders and employees Anyone with a web browser and the knowledge from Chapter One of SQL for Dummies could have easily accessed and possibly, changed any data within the DOC's databases" slide 22
23 Attack on Microsoft IIS (April 2008) slide 23
24 Main Steps in April 2008 Attack Use Google to find sites using a particular ASP style vulnerable to SQL injection Use SQL injection to modify the pages to include a link to a Chinese site nihaorr1.com Do not visit that site it serves JavaScript that exploits vulnerabilities in IE, RealPlayer, QQ Instant Messenger Attack used automatic tool; can be configured to inject whatever you like into vulnerable sites There is some evidence that hackers may get paid for each victim s visit to nihaorr1.com slide 24
25 Part of the SQL Attack String varchar(255) DECLARE Table_Cursor CURSOR FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=rtrim(convert(varchar,['+@C+']))+' ''') FETCH NEXT FROM Table_Cursor END CLOSE Table_Cursor DEALLOCATE Table_Cursor; DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST( %20AS%20NVARCHAR(4000));EXEC(@S);-- slide 25
26 Preventing SQL Injection Input validation Filter Apostrophes, semicolons, percent symbols, hyphens, underscores, Any character that has special meanings Check the data type (e.g., make sure it s an integer) Whitelisting Blacklisting bad characters doesn t work Forget to filter out some characters Could prevent valid input (e.g., last name O Brien) Allow only well-defined set of safe values Set implicitly defined through regular expressions slide 26
27 Escaping Quotes For valid string inputs use escape characters to prevent the quote becoming part of the query Example: escape(o connor) = o connor Convert into \ Only works for string inputs Different databases have different rules for escaping slide 27
28 Prepared Statements Metacharacters such as in queries provide distinction between data and control In most injection attacks data are interpreted as control this changes the semantics of a query or a command Bind variables:? placeholders guaranteed to be data (not control) Prepared statements allow creation of static queries with bind variables preserves the structure of intended query slide 28
29 Prepared Statement: Example PreparedStatement ps = db.preparestatement("select pizza, toppings, quantity, order_day " + "FROM orders WHERE userid=? AND order_month=?"); ps.setint(1, session.getcurrentuserid()); ps.setint(2, Integer.parseInt(request.getParamenter("month"))); ResultSet res = ps.executequery(); Bind variable (data placeholder) Query parsed without parameters Bind variables are typed (int, string, ) slide 29
30 Parameterized SQL in ASP.NET Builds SQL queries by properly escaping args Replaces with \ SqlCommand cmd = new SqlCommand( SELECT * FROM UserTable WHERE username AND password dbconnection); Request[ user ] ); Request[ pwd ] ); cmd.executereader(); slide 30
31 G. Wassermann and Z. Su Sound and Precise Analysis of Web Applications for Injection Vulnerabilities (PLDI 2007) slide 31
32 Wassermann-Su Approach Focuses on SQL injection vulnerabilities Soundness Tool is guaranteed to find all vulnerabilities Precision Models semantics of sanitization functions Models the structure of the SQL query into which untrusted user inputs are fed slide 32
33 Essence of SQL Injection Web app provides a template for the SQL query Attack = any query in which user input changes the intended structure of SQL query Model strings as context-free grammars (CFG) Track non-terminals representing tainted input Model string operations as language tranducers Example: str_replace(,, $input) A matches any char except slide 33
34 Phase One: Grammar Production Generate annotated CFG representing set of all query strings that program can generate Direct: data directly from users (e.g., GET parameters) Indirect: second-order tainted data (means what?) slide 34
35 String Analysis + Taint Analysis Convert program into static single assignment form, then into CFG Reflects data dependencies Model PHP filters as string transducers Some filters are more complex: preg_replace( /a([0-9]*)b/, x\\1\\1y, a01ba3b ) produces x0101yx33y Propagate taint annotations slide 35
36 Phase Two: Checking Safety Check whether the language represented by CFG contains unsafe queries Is it syntactically contained in the language defined by the application s query template? This non-terminal represents tainted input For all sentences of the form 1 GETUID 2 derivable from query, GETUID is between quotes in the position of an SQL string literal (means what?) Safety check: Does the language rooted in GETUID contain unescaped quotes? slide 36
37 Tainted Substrings as SQL Literals Tainted substrings that cannot be syntactically confined in any SQL query Any string with an odd # of unescaped quotes (why?) Nonterminals that occur only in the syntactic position of SQL string literals Can an unconfined string be derived from it? Nonterminals that derive numeric literals only Remaining nonterminals in literal position can produce a non-numeric string outside quotes Probably an SQL injection vulnerability Test if it can derive DROP WHERE, --, etc. slide 37
38 Taints in Non-Literal Positions Remaining tainted nonterminals appear as nonliterals in SQL query generated by the application This is rare (why?) All derivable strings should be proper SQL statements Context-free language inclusion is undecidable Approximate by checking whether each derivable string is also derivable from a nonterminal in the SQL grammar Variation on a standard algorithm slide 38
39 Evaluation Testing on five real-world PHP applications Discovered previously unknown vulnerabilities, including non-trivial ones Vulnerability in e107 content management system: a field is read from a user-modifiable cookie, used in a query in a different file 21% false positive rate What are the sources of false positives?
40 Example of a False Positive slide 40
SQL Injection. Slides thanks to Prof. Shmatikov at UT Austin
SQL Injection Slides thanks to Prof. Shmatikov at UT Austin Dynamic Web Application GET / HTTP/1.0 Browser HTTP/1.1 200 OK Web server index.php Database server slide 2 PHP: Hypertext Preprocessor Server
More informationAgenda. SQL Injection Impact in the Real World. 8.1. Attack Scenario (1) CHAPTER 8 SQL Injection
Agenda CHAPTER 8 SQL Injection Slides adapted from "Foundations of Security: What Every Programmer Needs To Know" by Neil Daswani, Christoph Kern, and Anita Kesavan (ISBN 1590597842; http://www.foundationsofsecurity.com).
More informationBotnet-Powered SQL Injection Attacks A Deeper Look Within (VB, Sep. 2009) David Maciejak Guillaume Lovet
Botnet-Powered SQL Injection Attacks A Deeper Look Within (VB, Sep. 2009) David Maciejak Guillaume Lovet Agenda 1 2 3 The Beginning Attack Analysis Malicious Injected JS 4 Threat Evolution 5 Prevention
More informationCIS 433/533 - Computer and Network Security. Web Vulnerabilities, Wrapup
CIS 433/533 - Computer and Network Security Web Vulnerabilities, Wrapup Professor Kevin Butler Winter 2011 Computer and Information Science Injection Attacks flaws relating to invalid input handling which
More informationUnderstanding Web Application Security Issues
Understanding Web Application Security Issues Pankaj Sharma January 30, 2009 Indian Computer Emergency Response Team ( CERT - IN ) Department Of Information Technology 1 Agenda Introduction What are Web
More informationSQL Injection January 23, 2013
Web-based Attack: SQL Injection SQL Injection January 23, 2013 Authored By: Stephanie Reetz, SOC Analyst Contents Introduction Introduction...1 Web applications are everywhere on the Internet. Almost Overview...2
More informationWebapps Vulnerability Report
Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during
More informationDawn Song dawnsong@cs.berkeley.edu
1 Web Security Dawn Song dawnsong@cs.berkeley.edu Common Vulnerabilities Input validation SQL Injection XSS: cross-site scripting HTTP response splitting Cookie management Cookie forgery CSRF: cross-site
More informationSQL INJECTION ATTACKS By Zelinski Radu, Technical University of Moldova
SQL INJECTION ATTACKS By Zelinski Radu, Technical University of Moldova Where someone is building a Web application, often he need to use databases to store information, or to manage user accounts. And
More informationHow I hacked PacketStorm (1988-2000)
Outline Recap Secure Programming Lecture 8++: SQL Injection David Aspinall, Informatics @ Edinburgh 13th February 2014 Overview Some past attacks Reminder: basics Classification Injection route and motive
More informationCSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
More informationStill Aren't Doing. Frank Kim
Ten Things Web Developers Still Aren't Doing Frank Kim Think Security Consulting Background Frank Kim Consultant, Think Security Consulting Security in the SDLC SANS Author & Instructor DEV541 Secure Coding
More informationCheck list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
More informationMagento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
More informationThreat Modeling. Categorizing the nature and severity of system vulnerabilities. John B. Dickson, CISSP
Threat Modeling Categorizing the nature and severity of system vulnerabilities John B. Dickson, CISSP What is Threat Modeling? Structured approach to identifying, quantifying, and addressing threats. Threat
More informationWeb Applications Security: SQL Injection Attack
Web Applications Security: SQL Injection Attack S. C. Kothari CPRE 556: Lecture 8, February 2, 2006 Electrical and Computer Engineering Dept. Iowa State University SQL Injection: What is it A technique
More informationCHAPTER 5 INTELLIGENT TECHNIQUES TO PREVENT SQL INJECTION ATTACKS
66 CHAPTER 5 INTELLIGENT TECHNIQUES TO PREVENT SQL INJECTION ATTACKS 5.1 INTRODUCTION In this research work, two new techniques have been proposed for addressing the problem of SQL injection attacks, one
More informationSQL Injection. By Artem Kazanstev, ITSO and Alex Beutel, Student
SQL Injection By Artem Kazanstev, ITSO and Alex Beutel, Student SANS Priority No 2 As of September 2009, Web application vulnerabilities such as SQL injection and Cross-Site Scripting flaws in open-source
More informationAdvanced Tornado TWENTYONE. 21.1 Advanced Tornado. 21.2 Accessing MySQL from Python LAB
21.1 Advanced Tornado Advanced Tornado One of the main reasons we might want to use a web framework like Tornado is that they hide a lot of the boilerplate stuff that we don t really care about, like escaping
More informationWeb Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
More informationAdvanced Web Technology 10) XSS, CSRF and SQL Injection 2
Berner Fachhochschule, Technik und Informatik Advanced Web Technology 10) XSS, CSRF and SQL Injection Dr. E. Benoist Fall Semester 2010/2011 Table of Contents Cross Site Request Forgery - CSRF Presentation
More informationTo Cache a Thief Using database caches to detect SQL injection attacks. Kevvie Fowler, CISSP, GCFA Gold, MCTS, MCDBA, MCSD, MCSE
To Cache a Thief Using database caches to detect SQL injection attacks Kevvie Fowler, CISSP, GCFA Gold, MCTS, MCDBA, MCSD, MCSE About me Day job: Director Security Services, TELUS backed by Emergis Night
More informationExternal Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security
More informationKEYWORDS: Internet Applications, Security, Languages, Review and evaluation.
[Madhusudhanan, 4(3): March, 2015] ISSN: 2277-9655 IJESRT INTERNATIONAL JOURNAL OF ENGINEERING SCIENCES & RESEARCH TECHNOLOGY WEB SECURITY VULNERABILITY ASSESSMENT AND RECOVERY MACHANISAM M.Madhusudhanan*,
More informationWhat is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
More informationDetection and Prevention of SQL Injection Attacks
Detection and Prevention of SQL Injection Attacks 1 Sailor Pratik, 2 Prof. Jaydeep Gheewala 1 Computer Department 1 Sarvajanik College of Engineering and Technology, Surat, Gujarat, India 1 pratik_sailor@ymail.com,
More informationExposed Database( SQL Server) Error messages Delicious food for Hackers
Exposed Database( SQL Server) Error messages Delicious food for Hackers The default.asp behavior of IIS server is to return a descriptive error message from the application. By attacking the web application
More informationMapReduce. MapReduce and SQL Injections. CS 3200 Final Lecture. Introduction. MapReduce. Programming Model. Example
MapReduce MapReduce and SQL Injections CS 3200 Final Lecture Jeffrey Dean and Sanjay Ghemawat. MapReduce: Simplified Data Processing on Large Clusters. OSDI'04: Sixth Symposium on Operating System Design
More informationSQL injection: Not only AND 1=1. The OWASP Foundation. Bernardo Damele A. G. Penetration Tester Portcullis Computer Security Ltd
SQL injection: Not only AND 1=1 Bernardo Damele A. G. Penetration Tester Portcullis Computer Security Ltd bernardo.damele@gmail.com +44 7788962949 Copyright Bernardo Damele Assumpcao Guimaraes Permission
More informationSQL Injection. The ability to inject SQL commands into the database engine through an existing application
SQL Injection The ability to inject SQL commands into the database engine through an existing application 1 What is SQL? SQL stands for Structured Query Language Allows us to access a database ANSI and
More informationExternal Network & Web Application Assessment. For The XXX Group LLC October 2012
External Network & Web Application Assessment For The XXX Group LLC October 2012 This report is solely for the use of client personal. No part of it may be circulated, quoted, or reproduced for distribution
More information1. What is SQL Injection?
SQL Injection 1. What is SQL Injection?...2 2. Forms of vulnerability...3 2.1. Incorrectly filtered escape characters...3 2.2. Incorrect type handling...3 2.3. Vulnerabilities inside the database server...4
More informationWeb Security CS25010. 20th November 2012. 2012, Jonathan Francis Roscoe, jjr6@aber.ac.uk Department of Computer Science, Aberystwyth University
Web Security CS25010 20th November 2012 Session Errors Some people are having errors creating sessions: Warning: session_start() [function.session-start]: open(/var/php_sessions/sess_d7hag76hgsfh2bjuhmdamb974,
More informationAn Effective Approach for Detecting and Preventing Sqlinjection Attacks
An Effective Approach for Detecting and Preventing Sqlinjection Attacks M. Roslinmary 1, S. Sivasakthi 2, A. Shenbaga Bharatha Priya 3 1, 2, 3 PG scholar, Department of IT, Dr. Sivanthi Aditanar College
More informationCracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference
Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance
More informationCross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) Vijaya
More informationWeb Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
More informationA Review of Web Application Security for Preventing Cyber Crimes
International Journal of Information & Computation Technology. ISSN 0974-2239 Volume 4, Number 7 (2014), pp. 699-704 International Research Publications House http://www. irphouse.com A Review of Web Application
More informationAdvanced Web Security, Lab
Advanced Web Security, Lab Web Server Security: Attacking and Defending November 13, 2013 Read this earlier than one day before the lab! Note that you will not have any internet access during the lab,
More informationSECURING APACHE : THE BASICS - III
SECURING APACHE : THE BASICS - III Securing your applications learn how break-ins occur Shown in Figure 2 is a typical client-server Web architecture, which also indicates various attack vectors, or ways
More informationSecurity Test s i t ng Eileen Donlon CMSC 737 Spring 2008
Security Testing Eileen Donlon CMSC 737 Spring 2008 Testing for Security Functional tests Testing that role based security functions correctly Vulnerability scanning and penetration tests Testing whether
More informationTesting Web Applications for SQL Injection Sam Shober SamShober@Hotmail.com
Testing Web Applications for SQL Injection Sam Shober SamShober@Hotmail.com Abstract: This paper discusses the SQL injection vulnerability, its impact on web applications, methods for pre-deployment and
More informationWeb Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
More informationCreating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
More informationSQL Injection Attack Lab Using Collabtive
Laboratory for Computer Security Education 1 SQL Injection Attack Lab Using Collabtive (Web Application: Collabtive) Copyright c 2006-2011 Wenliang Du, Syracuse University. The development of this document
More informationAn Introduction to Application Security In ASP.NET Environments. Houston.NET User Group. February 23 rd, 2006
An Introduction to Application Security In ASP.NET Environments Houston.NET User Group February 23 rd, 2006 Overview Background What is Application Security and Why Is It Important? Examples ASP.NET Specific
More informationEVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
More informationCS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
More informationPenetration Test Report
Penetration Test Report Acme Test Company ACMEIT System 26 th November 2010 Executive Summary Info-Assure Ltd was engaged by Acme Test Company to perform an IT Health Check (ITHC) on the ACMEIT System
More informationA SQL Injection : Internal Investigation of Injection, Detection and Prevention of SQL Injection Attacks
A SQL Injection : Internal Investigation of Injection, Detection and Prevention of SQL Injection Attacks Abhay K. Kolhe Faculty, Dept. Of Computer Engineering MPSTME, NMIMS Mumbai, India Pratik Adhikari
More information3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org
More informationØredev 2006. Web application testing using a proxy. Lucas Nelson, Symantec Inc.
Øredev 2006 Web application testing using a proxy Lucas Nelson, Symantec Inc. Agenda What is a proxy? Setting up your environment Pre-login tests Post-login tests Conclusion A man in the middle proxy The
More informationEnhanced Model of SQL Injection Detecting and Prevention
Enhanced Model of SQL Injection Detecting and Prevention Srinivas Baggam, Assistant Professor, Department of Computer Science and Engineering, MVGR College of Engineering, Vizianagaram, India. b_srinio@yahoo.com
More informationWeb Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
More informationWeb Application Security. Srikumar Venugopal S2, Week 8, 2013
Web Application Security Srikumar Venugopal S2, Week 8, 2013 Before we start Acknowledgements This presentation contains material prepared by Halvard Skogsrud, Senior Software Engineer, Thoughtworks, Inc.
More informationSQL Injection 2.0: Bigger, Badder, Faster and More Dangerous Than Ever. Dana Tamir, Product Marketing Manager, Imperva
SQL Injection 2.0: Bigger, Badder, Faster and More Dangerous Than Ever Dana Tamir, Product Marketing Manager, Imperva Consider this: In the first half of 2008, SQL injection was the number one attack vector
More informationUnderstanding Sql Injection
Understanding Sql Injection Hardik Shah Understanding SQL Injection Introduction: SQL injection is a technique used by a malicious user to gain illegal access on the remote machines through the web applications
More informationCTF Web Security Training. Engin Kirda ek@ccs.neu.edu
CTF Web Security Training Engin Kirda ek@ccs.neu.edu Web Security Why It is Important Easiest way to compromise hosts, networks and users Widely deployed ( payload No Logs! (POST Request Difficult to defend
More informationIs Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
More informationDatabase System Security. Paul J. Wagner UMSSIA 2008
Database System Security Paul J. Wagner UMSSIA 2008 Need for Database System Security Education The value is in the data 3M Poster Attacks have changed from glory-seeking to attempted financial gain Security
More informationGenerating Effective Attacks for Efficient and Precise Penetration Testing against SQL Injection
Regular Paper Generating Effective Attacks for Efficient and Precise Penetration Testing against SQL Injection Yuji Kosuga, 1 Miyuki Hanaoka 1 and Kenji Kono 1, 2 An SQL injection attack is one of the
More informationRole Based Access Control. Using PHP Sessions
Role Based Access Control Using PHP Sessions Session Developed in PHP to store client data on the web server, but keep a single session ID on the client machine (cookie) The session ID : identifies the
More informationWeb-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
More informationWeb applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
More informationWith so many web applications, universities have a huge attack surface often without the IT security budgets or influence to back it up.
1 2 Why do we care about web application security? With so many web applications, universities have a huge attack surface often without the IT security budgets or influence to back it up. We constantly
More informationFINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
More informationToward A Taxonomy of Techniques to Detect Cross-site Scripting and SQL Injection Vulnerabilities
NCSU CSC TR 2008-4 1 Toward A Taxonomy of Techniques to Detect Cross-site Scripting and SQL Injection Vulnerabilities Yonghee SHIN, Laurie WILLIAMS, Members, IEEE Abstract Since 2002, over half of reported
More informationWeb application security: Testing for vulnerabilities
Web application security: Testing for vulnerabilities Using open source tools to test your site Jeff Orloff Technology Coordinator/Consultant Sequoia Media Services Inc. Skill Level: Intermediate Date:
More informationRuby on Rails Secure Coding Recommendations
Introduction Altius IT s list of Ruby on Rails Secure Coding Recommendations is based upon security best practices. This list may not be complete and Altius IT recommends this list be augmented with additional
More informationIntegrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
More informationA Survey on Security and Vulnerabilities of Web Application
A Survey on Security and Vulnerabilities of Web Application Gopal R. Chaudhari, Prof. Madhav V. Vaidya Department of Information Technology, SGGS IE & T, Nanded, Maharashtra, India-431606 Abstract Web
More informationSQL Injection Attack. David Jong hoon An
SQL Injection Attack David Jong hoon An SQL Injection Attack Exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either
More informationGuarding Against SQL Server Attacks: Hacking, cracking, and protection techniques.
Guarding Against SQL Server Attacks: Hacking, cracking, and protection techniques. In this information age, the data server has become the heart of a company. This one piece of software controls the rhythm
More informationCommon Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited
More informationApplication Design and Development
C H A P T E R9 Application Design and Development Practice Exercises 9.1 What is the main reason why servlets give better performance than programs that use the common gateway interface (CGI), even though
More informationThe purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
More informationMaintaining Stored Procedures in Database Application
Maintaining Stored Procedures in Database Application Santosh Kakade 1, Rohan Thakare 2, Bhushan Sapare 3, Dr. B.B. Meshram 4 Computer Department VJTI, Mumbai 1,2,3. Head of Computer Department VJTI, Mumbai
More informationCyber Security Challenge Australia 2014
Cyber Security Challenge Australia 2014 www.cyberchallenge.com.au CySCA2014 Web Penetration Testing Writeup Background: Pentest the web server that is hosted in the environment at www.fortcerts.cysca Web
More informationSQL Injection Vulnerabilities in Desktop Applications
Vulnerabilities in Desktop Applications Derek Ditch (lead) Dylan McDonald Justin Miller Missouri University of Science & Technology Computer Science Department April 29, 2008 Vulnerabilities in Desktop
More informationINF 212 ANALYSIS OF PROG. LANGS ADVERSITY. Instructors: Crista Lopes Copyright Instructors.
INF 212 ANALYSIS OF PROG. LANGS ADVERSITY Instructors: Crista Lopes Copyright Instructors. random quotes. just because We have forty million reasons for failure, but not a single excuse. It's fine to celebrate
More informationSQL Injection Attack Lab
Laboratory for Computer Security Education 1 SQL Injection Attack Lab Copyright c 2006-2010 Wenliang Du, Syracuse University. The development of this document is funded by the National Science Foundation
More informationDetecting (and even preventing) SQL Injection Using the Percona Toolkit and Noinject!
Detecting (and even preventing) SQL Injection Using the Percona Toolkit and Noinject! Justin Swanhart Percona Live, April 2013 INTRODUCTION 2 Introduction 3 Who am I? What do I do? Why am I here? The tools
More information1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
More informationAn Efficient Black-box Technique for Defeating Web Application Attacks
2/9/2009 An Efficient Black-box Technique for Defeating Web Application Attacks R. Sekar Stony Brook University (Research supported by DARPA, NSF and ONR) Example: SquirrelMail Command Injection Attack:
More informationWeb Application Security
Web Application Security Ng Wee Kai Senior Security Consultant PulseSecure Pte Ltd About PulseSecure IT Security Consulting Company Part of Consortium in IDA (T) 606 Term Tender Cover most of the IT Security
More informationINTRUSION PROTECTION AGAINST SQL INJECTION ATTACKS USING REVERSE PROXY
INTRUSION PROTECTION AGAINST SQL INJECTION ATTACKS USING REVERSE PROXY Asst.Prof. S.N.Wandre Computer Engg. Dept. SIT,Lonavala University of Pune, snw.sit@sinhgad.edu Gitanjali Dabhade Monika Ghodake Gayatri
More informationWeb Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability WWW Based upon HTTP and HTML Runs in TCP s application layer Runs on top of the Internet Used to exchange
More informationDatabase security issues PETRA BILIĆ ALEXANDER SPARBER
Database security issues PETRA BILIĆ ALEXANDER SPARBER Introduction Database security is one aspect of computer security It uses different information security controls to protect databases Information
More informationSerious Threat. Targets for Attack. Characterization of Attack. SQL Injection 4/9/2010 COMP620 1. On August 17, 2009, the United States Justice
Serious Threat SQL Injection COMP620 On August 17, 2009, the United States Justice Department tcharged an American citizen Albert Gonzalez and two unnamed Russians with the theft of 130 million credit
More informationA Tokenization and Encryption based Multi-Layer Architecture to Detect and Prevent SQL Injection Attack
A Tokenization and Encryption based Multi-Layer Architecture to Detect and Prevent SQL Injection Attack Mr. Vishal Andodariya PG Student C. U. Shah College Of Engg. And Tech., Wadhwan city, India vishal90.ce@gmail.com
More informationPerl In Secure Web Development
Perl In Secure Web Development Jonathan Worthington (jonathan@jwcs.net) August 31, 2005 Perl is used extensively today to build server side web applications. Using the vast array of modules on CPAN, one
More informationDiscovering passwords in the memory
Discovering passwords in the memory Abhishek Kumar (abhishek.kumar@paladion.net) November 2003 Escalation of privileges is a common method of attack where a low privileged user exploits a vulnerability
More informationJOOMLA SECURITY. ireland website design. by Oliver Hummel. ADDRESS Unit 12D, Six Cross Roads Business Park, Waterford City
JOOMLA SECURITY by Oliver Hummel ADDRESS Unit 12D, Six Cross Roads Business Park, Waterford City CONTACT Nicholas Butler 051-393524 089-4278112 info@irelandwebsitedesign.com Contents Introduction 3 Installation
More informationLive Hacking. Threats & Countermeasures in Action (SEC411) Ofer Maor CTO Hacktics Ltd.
Live Hacking Threats & Countermeasures in Action (SEC411) Ofer Maor CTO Hacktics Ltd. Agenda Introduction to Application Hacking Demonstration of Attack Tool Common Web Application Attacks & Countermeasures
More informationUniversity of Wisconsin Platteville SE411. Senior Seminar. Web System Attacks. Maxwell Friederichs. April 18, 2013
University of Wisconsin Platteville SE411 Senior Seminar Web System Attacks Maxwell Friederichs April 18, 2013 Abstract 1 Data driven web applications are at the cutting edge of technology, and changing
More informationStart Secure. Stay Secure. Blind SQL Injection. Are your web applications vulnerable? By Kevin Spett
Are your web applications vulnerable? By Kevin Spett Table of Contents Introduction 1 What is? 1 Detecting Vulnerability 2 Exploiting the Vulnerability 3 Solutions 6 The Business Case for Application Security
More informationCyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
More informationToken Sequencing Approach to Prevent SQL Injection Attacks
IOSR Journal of Computer Engineering (IOSRJCE) ISSN : 2278-0661 Volume 1, Issue 1 (May-June 2012), PP 31-37 Token Sequencing Approach to Prevent SQL Injection Attacks ManveenKaur 1,Arun Prakash Agrawal
More informationCross Site Scripting (XSS) and PHP Security. Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011
Cross Site Scripting (XSS) and PHP Security Anthony Ferrara NYPHP and OWASP Security Series June 30, 2011 What Is Cross Site Scripting? Injecting Scripts Into Otherwise Benign and Trusted Browser Rendered
More information